Since July 1, 2026, the Connecticut Data Privacy Act (CTDPA) reaches far more businesses. It now covers any company that handles the personal data of at least 35,000 consumers, down from 100,000, and any company that processes sensitive data such as health information, or sells personal data, at any volume. A covered business's website needs a privacy notice linked from the homepage, working opt-outs for targeted advertising and data sales that also honor browser signals like Global Privacy Control, and consent before it collects sensitive data.
Many Greenwich and Fairfield County businesses that were too small to be covered in 2023 may now be inside the law: a med spa with an online intake form, a therapy practice, an online store running ad pixels. This guide covers what changed, how to tell whether the law applies to you, and a website checklist a developer can work through. It isn't legal advice. The amendments are new, and a privacy attorney should confirm your obligations.
What changed on July 1, 2026
The changes come from Public Act 25-113 (Senate Bill 1295), signed in June 2025. Most took effect on July 1, 2026, and a new impact-assessment duty for certain profiling decisions applies to processing that begins on or after August 1, 2026. The table summarizes the changes that matter most for a typical small or mid-size business website, based on the statute and summaries by Foley & Lardner and Snell & Wilmer.
| July 2023 to June 2026 | From July 1, 2026 | |
|---|---|---|
| Volume trigger | 100,000 Connecticut consumers (payment-only data excluded) | 35,000 Connecticut consumers (payment-only data excluded) |
| Data-sale trigger | 25,000 consumers and more than 25% of revenue from selling data | Any sale of personal data, at any volume |
| Sensitive data | Consent required, but only for businesses over a threshold | Processing any sensitive data brings a business under the law |
| Privacy notice | Required, with set contents | Also linked from the homepage with the word "privacy"; must say whether personal data trains large language models |
| Minors | Consent needed for targeted ads or sale for known 13- to 15-year-olds | Targeted advertising and sale barred for known 13- to 17-year-olds, even with consent |
| Financial institutions | Entity-level exemption under Gramm-Leach-Bliley | Data-level exemption only |
Does the CTDPA apply to your business?
The law applies to businesses that operate in Connecticut or target products or services to Connecticut residents and, during the preceding calendar year, met any one of the triggers above. For most local service businesses, the question isn't volume. It's whether they touch sensitive data.
What counts as sensitive data
The statute defines sensitive data as data revealing racial or ethnic origin, religious beliefs, a mental or physical health condition or diagnosis, sex life, sexual orientation, or citizenship or immigration status; consumer health data; genetic or biometric data used to identify someone; personal data collected from a known child; crime-victim status; and precise geolocation (location accurate to within 1,750 feet). The 2025 amendments add further categories, including neural data and certain financial account information. A booking form that asks about medications, an intake form that asks about injuries, or a store that uses precise location can all put a business in scope.
Who is exempt
The statute exempts state agencies, nonprofit organizations, institutions of higher education, HIPAA covered entities and business associates, and certain other regulated entities. The 2025 amendments narrowed the financial-institution exemption so it covers data subject to the Gramm-Leach-Bliley Act rather than whole institutions. Before relying on any exemption, confirm with counsel whether it still applies to your organization as amended.
Health data rules apply regardless of size
Connecticut's consumer health data provisions (C.G.S. § 42-526) have applied since 2023 to any business operating in the state, with no size threshold, unless it is a HIPAA covered entity, a business associate or another exempt organization. "Consumer health data" means personal data used to identify a consumer's physical or mental health condition or diagnosis. Covered businesses may not give staff or contractors access without a duty of confidentiality, may not share it with vendors except under a compliant processing contract, may not sell it without consent and may not use a geofence within 1,750 feet of a mental health, reproductive or sexual health facility to track or message people about their health.
On a website, the usual problem is an ad pixel on a page that reveals a health interest, such as a treatment inquiry, a symptom checker or a booking confirmation for a specific service. Our guide to Connecticut medical spa regulations walks through how this plays out for cash-pay practices.
Your privacy notice: what the website must show
Section 42-520 already required a clear, accessible privacy notice listing the categories of personal data you process, why you process it, how consumers exercise their rights and appeal your decisions, the categories of data you share with third parties and the categories of those third parties, and an active email address or online contact method. If you sell data or use it for targeted advertising, you must disclose that clearly and conspicuously along with how to opt out.
The amendments add website-specific requirements. According to Foley & Lardner's summary, the notice must be reachable through a conspicuous homepage link that includes the word "privacy," must be offered in every language you use to do business, must be accessible to people with disabilities, and must say whether you use personal data to train large language models. A footer link labeled "Privacy Policy" on every page covers the first point; an accessible HTML page, rather than a scanned PDF, covers the fourth.
Run a pixel and form audit
Website privacy problems often come from tags someone added years ago and forgot. For a small business site, an audit is usually a short, well-defined project.
Inventory every tag
List each script and pixel (analytics, ads, chat, heatmaps, video, booking) and what data it sends to whom.
Map tags to pages
Flag any advertising tag on pages that reveal sensitive information, such as health-related services, intake forms or booking confirmations, and remove it there.
Check forms
Collect only the fields you need. Sensitive fields need a consent step and a vendor contract that meets § 42-521.
Test opt-outs
Confirm that the opt-out link works and that a GPC signal stops advertising tags on the first page load.
Update the notice
Rewrite the privacy notice to match what the audit found, add the LLM-training disclosure and link it from the homepage.
Repeat on every redesign
Review new tags before they go live.
Enforcement: no automatic grace period
The Attorney General has exclusive authority to enforce the CTDPA, and there is no private right of action. A violation counts as an unfair trade practice under Connecticut's Unfair Trade Practices Act, where willful violations can carry civil penalties of up to $5,000 each. The mandatory 60-day cure period expired on December 31, 2024. Since then, the Attorney General may offer a chance to cure but doesn't have to, weighing factors such as the number of violations and the size of the business.
CTDPA website checklist
Decide whether you're covered
Check the 35,000-consumer, sensitive-data and data-sale triggers and your exemptions with counsel.
Homepage privacy link
A conspicuous link containing the word "privacy" on the homepage, ideally in the footer of every page.
Complete notice
Data categories, purposes, rights and appeals, third-party sharing, a contact method and the LLM-training statement.
Opt-out page
A working link to opt out of targeted advertising and sales, plus Global Privacy Control honored automatically.
Sensitive-data consent
Consent before any form collects health or other sensitive data, and a way to withdraw it that's just as easy.
Clean health pages
No advertising pixels on pages that reveal a health interest.
Vendor contracts
Processing agreements with every form, booking and analytics vendor that receives personal data.
Teen audiences
If you know users may be 13 to 17, no targeted advertising or sale of their data.
Building privacy into a new website
On a new build or redesign, we can include the tag inventory, a consent setup that honors Global Privacy Control and forms that collect only what they need as part of the project scope. If you're planning a redesign anyway, it's the cheapest moment to fix privacy, because the audit becomes part of the build. Our web design service covers new sites from $699 for a landing page and $2,500 for a full business site, and our pricing page lists every tier. For regulated industries, see how the rules apply to med spas, dental practices and medical practices.
Frequently asked questions
Does the Connecticut Data Privacy Act apply to small businesses?
It can. Since July 1, 2026, the CTDPA applies to businesses operating in Connecticut or targeting its residents that, in the preceding calendar year, processed the personal data of at least 35,000 consumers, processed any sensitive data, or sold any personal data. A small practice or studio that collects health information through a website form can be covered regardless of size. Nonprofits, HIPAA covered entities and some other organizations are exempt.
What must a website privacy notice include under the CTDPA?
The notice must list the categories of personal data processed, the purposes, how consumers can exercise their rights and appeal, the categories of data shared with third parties and the categories of those third parties, and an active email address or online contact method. It must disclose any sale or targeted advertising and how to opt out. Under the 2025 amendments it must also be linked from the homepage with a link containing the word privacy and state whether personal data is used to train large language models.
Do Connecticut websites have to honor Global Privacy Control?
Yes, for covered businesses. Since January 1, 2025, the CTDPA has required controllers to let consumers opt out of targeted advertising and data sales through an opt-out preference signal such as Global Privacy Control. Your consent tool should detect the signal and suppress advertising tags automatically on the first page load.
What are the penalties for violating the Connecticut Data Privacy Act?
The Attorney General enforces the CTDPA exclusively; consumers can't sue under it. Violations are treated as unfair trade practices under Connecticut's Unfair Trade Practices Act, where willful violations can carry civil penalties of up to $5,000 each. The mandatory 60-day cure period ended on December 31, 2024, so any chance to fix a problem before enforcement is now at the Attorney General's discretion.
Treat privacy as part of the build
The 2026 amendments turned the CTDPA from a big-company law into one that reaches many local businesses, and the website is where most of the obligations surface: the notice, the opt-outs, the forms and the tags. A one-time audit fixes most of it, and building those checks into every redesign keeps it fixed.
If you'd like a privacy-aware rebuild or an audit of your current site's tags and forms, contact us and we'll send a fixed-scope quote within 24 hours.
